[SECURITY] [DSA 6607-1] [CVE-2026-109518] apt security update - man-in-the-middle arbitrary code execution

Support
1

Was Whonix affected? Relays? I would post links to release notes but the forum won’t let me.

Max Justicz discovered a vulnerability in the APT package manager. APT
can merge two different package downloads after an HTTP redirect gives
them the same URI. Improper file handling when resuming an HTTP download
allows a man-in-the-middle attacker to replace a package after
verification, resulting in the execution of arbitrary code as root.

For the stable distribution (trixie), this problem has been fixed in
version 3.0.4. Additionally this update addresses several out-of-bounds
access issues.

We recommend that you upgrade your apt packages.
1 Like
Whonix 18.2.4.2 - Point Release!
2

Whonix uses apt as it is based on Debian, so Whonix systems that have not updated apt to a fixed version are vulnerable. Due to torified updates, it is difficult for a malicious actor to use this bug to target a specific Whonix user. See:

(Note that the note about not all traffic going over Tor in the above link is specific to Kicksecure and does not apply to Whonix.)

1 Like
3

May be false. Whonix apt sources use https. Therefore, could be impossible to compromise. Requires http.

Only users which manually add http sources can be affected. Seems not likely.

Seems no.

1 Like
4

TLS is not impossible to compromise:

Should be considered useful but not safe to rely upon. I would still consider non-updated Whonix systems vulnerable to this.

1 Like
5

Version 18.2.4.3 - currently build in process - will be the same as version 18.2.4.2 - except for newer packages (including APT). A “rebuild release”.

1 Like
6

Non-Qubes version 18.2.4.3 has the fix included, uploaded and download links updated.

Whonix 18.2.4.2 - Point Release!